Privacy.

Edouard Larroche, sole trader operating under the name Dorynn, 50 rue Galliéni, 92240 Malakoff, France — contact@dorynn.com.

Dorynn has not appointed a data protection officer. Any question about your data should be sent to contact@dorynn.com.

Order: email address, chosen category and format, item brand and model, serial number if given, declared value band, availability, language. Clients have no account: access to their file goes through a personal link, of which only a fingerprint is kept.

Origin of the visit: campaign parameters (utm), referring site and landing page, stored with the order to measure the effectiveness of acquisition channels.

Preparation: photos of the item, its accessories and papers, and information added by the client. Their metadata, including location, is removed on receipt.

Session: the picture and sound of the video call are transmitted live and not recorded. Only the times of entering and leaving the room are kept, together with the expert’s observations that make up the report.

Follow-up: rating left on the report, disputes filed (point concerned, reason, message), notification preferences for the file and, in the app, the device’s notification token.

A person who receives a share link views the report without creating an account. If they dispute the report, their email address is kept to send them the decision; it is never disclosed to the client.

The report never contains the client’s email address.

Application: name, email address, category, experience, availability, introduction. A normalised form of the email address is used to apply the technical assessment attempt limit from one application to the next.

Technical assessment: questions drawn, answers, written notes, score, result and, where applicable, review request.

Expert account: email address, password (stored as an argon2id hash), roles, language, accepted agreement (version and date), signed-in devices (device and app type, sign-in dates — never the IP address), notification preferences and tokens.

Public profile: name, category, city, tagline, languages, years of experience, introduction, specialties and photo, published in the directory after validation by Dorynn.

Payout details: account holder, IBAN and BIC, encrypted (AES-256-GCM); only the country and the last four characters remain readable, for display.

Contact forms: name, email address, phone number if given, subject and message.

Audience measurement: Plausible Analytics, without cookies, counts visits in aggregate. No data can identify a visitor or track them from one site to another.

Technical logs: servers record incoming requests (including the IP address) for security and diagnostics.

Performance of the contract: taking the order, assigning an expert, preparing and holding the session, writing, sealing, tracking and sharing the report, cancellation, handling disputes, emails and notifications about the file.

Pre-contractual steps and contract with experts: application, technical assessment, accreditation, account, public profile, payment of fees.

Legal obligation: keeping accounting records.

Legitimate interest: service security and fraud prevention (including multiple applications), protocol improvement, aggregate quality statistics (satisfaction, dispute rate, session length) and acquisition statistics.

Consent: app push notifications, enabled by the permission given in the phone settings and adjustable at any time.

Dorynn uses an AI model (Claude, by Anthropic) for three purposes: checking the quality of pre-inspection photos, writing a preparatory file for the expert, and grading written answers in the technical assessment.

For pre-inspection, the AI never gives an opinion on the item’s condition: only the expert reports, and nothing it produces goes into the report. The preparatory file is visible only to the expert handling the file.

The data sent (photos, texts, answers) is used only to produce the requested result; under Anthropic’s commercial terms, it is not used to train its models.

The result of the candidates’ technical assessment is calculated automatically: single-choice questions, states given to the points of the practical cases, written notes graded by AI. Above 75%, the assessment is passed; between 60 and 75%, a team member decides; below 60%, it is not passed.

Under article 22 of the GDPR, the candidate may at any time ask for a review by a member of the Dorynn team from the assessment page, express their point of view and contest the decision. The review covers the grading in detail.

The expert handling a file accesses the information needed for the session and the report: item description, slot, photos and preparatory file, client’s email address. They are bound to confidentiality by their agreement.

Processors: Vercel (website hosting), Render (application server and database, Frankfurt region), Cloudflare (photo storage), LiveKit (video calls, live transmission without recording), Resend (sending emails), Expo (app notifications), Anthropic (AI analyses), Plausible Insights (audience measurement, European Union).

Each accesses only the data needed for its service, under a processing agreement complying with article 28 of the GDPR. Some are based in the United States: transfers are covered by the EU–US Data Privacy Framework or by the European Commission’s standard contractual clauses.

No data is sold or transferred for advertising purposes.

Order and sealed report: five years after sealing, so the report can be checked during a sale and any complaint answered. Cancelled order: twelve months after cancellation.

Pre-inspection photos and preparatory file: twelve months after the session.

Session entry and exit times: twenty-four months.

Ratings and disputes: with the report they relate to. Email address of a third party who filed a dispute: three years after the decision.

Unsuccessful application and technical assessment: two years after the candidate’s last action.

Expert account: for the duration of the collaboration. When the account is deleted, the email address, password, devices, preferences, public profile and payout details are erased; the name and sealed reports are kept, as they serve as evidence.

Accounting records: ten years. Contact messages: three years after the last exchange. Notification tokens: until the app is uninstalled, the user signs out or the file is forgotten. Technical logs: a few weeks at most.

Exchanges are encrypted (HTTPS). Passwords are stored as argon2id hashes, bank details encrypted with AES-256-GCM, and file access links stored as fingerprints.

Photos are stored in a private space and can only be accessed through short-lived signed links. An account’s sessions can be closed remotely from Settings.

You have the right to access, rectify, erase, restrict and port your data, the right to object to processing based on legitimate interest, and the right to set instructions for what happens to your data after your death.

Experts export their data and request account deletion from Settings; deletion is handled within thirty days. Clients export their file’s data from their tracking page or from the app, and request erasure at contact@dorynn.com.

Any other request should be sent to contact@dorynn.com; you will receive a reply within one month. You may also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).

The site sets no advertising or audience-measurement cookies. It uses browser storage for strictly necessary purposes: a signed-in expert’s session, display theme, access to the open file (for the tab’s lifetime) and origin of the visit (for the visit’s lifetime).

The app keeps access to followed files and the expert’s session in the phone’s secure keychain.

This policy may change with the service. The date of the last update appears at the top of the page; in the event of a significant change, the people concerned are informed.